Ivanti warns of Connect Secure zero-day exploited in attacks

CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure, a remote-access gateway. It affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Attackers do not need privileges or user interaction.

The vulnerability is especially dangerous because a low-complexity attack can lead to arbitrary command execution on the appliance. Volexity says UTA0576 chained it with two other flaws to achieve unauthenticated root-level code execution, including on devices described as fully patched.

Ivanti reported limited exploitation in the wild and urged immediate upgrades. Customers should review the advisory, install a fixed version, and run the Integrity Checker Tool regularly. The urgency also reflects the gateway’s position at the edge of enterprise networks and the more than 5,500 ICS instances Shadowserver tracks online. Ivanti is still addressing one privilege escalation flaw used in the attack chain.

Ivanti Connect Secure, formerly Pulse Connect Secure and originally Juniper Pulse, is an enterprise-grade SSL VPN. It provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources. The appliance sits between outside users and internal services.

That position makes it valuable to attackers. The article describes recent flaws allowing authentication bypass, command injection, server-side request forgery, and remote code execution. A successful compromise can therefore turn a gateway into a platform for running commands or reaching protected organizational resources. The current vulnerability can be exploited remotely without privileges or user interaction.

The scale adds pressure. Shadowserver tracks more than 5,500 ICS instances exposed online, although it cannot say how many are honeypots or already secured. Ivanti has more than 40,000 customers worldwide, making these appliances an attractive target wherever vulnerable systems remain connected to the internet.

Shadowserver tracks over 5,500 Ivanti Connect Secure instances exposed to the internet. This is the article’s measure of visible ICS appliances, not a confirmed count of vulnerable or compromised devices. The source does not identify how many are honeypots or have already been secured against ongoing attacks.

The number matters because CVE-2026-104935 is remotely exploitable. An attacker does not need privileges or user interaction, and a low-complexity attack can execute arbitrary commands on an affected appliance. Each exposed, unpatched gateway could therefore represent another reachable target for the campaign described by Volexity.

The figure suggests potentially broad attack reach, but it cannot establish the campaign’s actual size. Ivanti has urged customers to upgrade to fixed versions and run its Integrity Checker Tool regularly. Security teams must determine their own exposure rather than treating the public count as a confirmed victim total.

CVE-2026-104935 lets a remote attacker bypass authentication on an affected ICS appliance. The attacker needs no privileges, and the attack requires no user interaction. The article says the flaw can be used to execute arbitrary commands on targeted devices.

Volexity reported that UTA0576 combined this vulnerability with two others to reach unauthenticated root-level code execution. Root-level access means the attacker operates with the highest device privileges described in the report. In this campaign, the actor re-exploited the appliance for every command, rather than leaving malware or a web shell behind.

Such access could let an intruder control the gateway and use its position around corporate and cloud resources. The article does not provide a complete list of damage caused by the campaign. It does report log tampering to hide activity and says Ivanti is still addressing a privilege escalation flaw used in the chain.

UTA0576 is a previously unknown threat actor identified and tracked by cybersecurity firm Volexity. Volexity said the actor had exploited CVE-2026-104935 since at least October 3. Defused separately reported the first signs of exploitation in the wild on October 1.

The actor chained the authentication bypass with two other vulnerabilities. That combination produced unauthenticated root-level code execution on devices Volexity described as fully patched. One part of the chain is a privilege escalation vulnerability that Ivanti was still working to address when the report was published.

UTA0576 used an unusual operating method. Volexity said it deployed no malware or web shell. Instead, it re-exploited the device for every command and tampered with logs. That approach helped the actor evade Ivanti’s Integrity Checker Tool. The campaign shows why fixing individual flaws may not be enough when attackers combine weaknesses and conceal evidence.

Installing a patch protects against the fixed vulnerability, but it does not automatically prove that an attacker never used it. If an intruder already gained access, traces may remain outside the patched flaw. The article reports that UTA0576 also used another privilege escalation vulnerability, which Ivanti was still addressing.

The actor’s method made detection harder. Volexity said UTA0576 deployed no malware or web shell. Instead, it re-exploited the appliance for every command and tampered with logs to cover its tracks. With no persistent payload and altered records, a checker looking for common signs could find little evidence.

Volexity specifically said this activity evaded Ivanti’s Integrity Checker Tool. Ivanti still recommends running the tool regularly, alongside upgrading to a fixed version. The report therefore points to two separate needs: prevent further exploitation and investigate possible earlier access, especially when logs or device behavior may have been manipulated.

A zero-day vulnerability is a newly disclosed or previously unknown security flaw that attackers exploit before defenders can fully respond. In this case, CVE-2026-104935 was actively exploited while Ivanti urged customers to patch immediately. The article labels it an authentication bypass zero-day.

VPN appliances are attractive because they directly connect remote users with corporate and cloud resources. They are also exposed at the internet boundary, where attackers can reach them without first entering an internal network. The current flaw requires no privileges or user interaction, and a low-complexity attack can run arbitrary commands.

Ivanti vulnerabilities have repeatedly been exploited as zero-days, according to the article. It lists several Connect Secure flaws fixed between 2024 and 2025, including authentication bypass, command injection, and remote code execution vulnerabilities. CISA has flagged 36 vulnerabilities across Ivanti products as actively exploited since November 2021, including 12 also abused by ransomware gangs.